TENDA AC19 · CVE-2026-123966 · Infrastructure
NO FIX YET
A heap-based buffer overflow in the saveParentControlInfo handler of Tenda AC19 routers (firmware 16.03.10.07) is triggered by an oversized deviceId argument sent to /goform/saveParentControlInfo. An attacker on the network can likely crash the router or run code on it, and a public exploit has been disclosed.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Owners of a Tenda AC19 router running firmware 16.03.10.07. VulDB says a remote attacker needs no login to send an oversized deviceId to /goform/saveParentControlInfo and cause a heap overflow, which can crash the router and may allow code execution. Exposure is highest if the admin interface is reachable from the internet; other models and firmware versions are not confirmed affected.
Not affected if different-firmware, different-model, management-not-exposed
Who cares ac19, firmware, home-router, router, tenda
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. This manipulation of the argument deviceId causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.